Is it possible to use a draytek to control access to the internet based on a username / password combination. I know that the draytek 2600's, 2800's probably cannot do this but not sure about the newer 2820 or other higher spec models ?.

As far as i can tell you control computers by ip address, not user login

Only by setting up a web proxy and setting user auth on the proxy, then blocking off all internet access except the proxy on the router.

Have you thought about this in depth, you'll kill windows update for people that don't have a username / password on the proxy.